# Standard Token Exchange is now officially supported in Keycloak 26.2

DevFeed: [Standard Token Exchange is now officially supported in Keycloak 26.2](<https://devfeed.tech/articles/standard-token-exchange-is-now-officially-supported-in-keycloak-26-2-31711.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2>)

Author: Giuseppe Graziano

Published: 2025-05-26T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [preview](<https://devfeed.tech/tags/preview.md>), [release](<https://devfeed.tech/tags/release.md>), [rules](<https://devfeed.tech/tags/rules.md>), [saml](<https://devfeed.tech/tags/saml.md>), [scopes](<https://devfeed.tech/tags/scopes.md>), [settings](<https://devfeed.tech/tags/settings.md>), [sso](<https://devfeed.tech/tags/sso.md>), [standard](<https://devfeed.tech/tags/standard.md>), [token](<https://devfeed.tech/tags/token.md>)

## AI overview

Keycloak 26.2 officially supports Standard Token Exchange and complies with OAuth 2.0 Token Exchange (RFC 8693). The feature lets clients exchange tokens, configure exchanges through the Admin Console, and enforce rules with Client Policies.

## Source excerpt

The Token Exchange feature has been available in Keycloak for a long time, but only as a preview feature. With the release of Keycloak 26.2, we're happy to share that Standard Token Exchange is now officially supported and fully compliant with OAuth 2.0 Token Exchange (RFC 8693). What is Token Exchange? 🔄 Token Exchange is a mechanism that allows a client to exchange one token for another. In the context of Keycloak, this means a client can exchange a token originally issued for another client and receive a new token issued specifically for itself. Token Exchange is especially helpful in these scenarios: 🎯 Different Audience When a token was issued for one service but needs to be used to access another, Token Exchange can issue a new token with the appropriate audience. 🔐 Scoped Permissions If a client needs to access a service with more limited permissions, it can exchange its token for one with reduced or more specific scopes. What's new? 🆕 ✅ Official support (no longer a preview feature) 📘 Compliance with RFC 8693 (OAuth 2.0 Token Exchange) 🖱 Simple configuration via the Admin Console (just a switch in client settings) 🛡 Integration with Client Policies to enforce custom rules. You can restrict exchanges to specific clients, or deny exchanges based on requested scopes. How to get started 🚀 If you're using Keycloak 26.2 or later, there's nothing extra to enable. Token Exchange is ready to use, just open the client settings in the admin console and enable the dedicated switch. If you're still using the preview feature of token exchange, check the migration guide and the comparison to understand the differences and plan your migration. 📄 For full setup instructions and configuration details, refer to the official documentation. What's next? 🔍 We're continuing to expand Token Exchange support with future enhancements such as: 🔄 Exchanging tokens issued by external identity providers 👤 Using token exchange to impersonate users Stay tuned for updates in upcoming rele